TCC Database

Overview

The TCC database is macOS's permission ledger. Every time a user (or admin) grants or denies an app access to a privacy-sensitive resource — camera, microphone, screen recording, contacts, the home directory, the entire disk — a row is written to TCC.db. For investigators, TCC is the canonical record of what an attacker's tooling could see.

Analysis Tips

• access table: Holds the grants. Key columns are service (resource type), client (bundle id), auth_value (0=denied, 2=allowed), last_modified
• System vs user TCC: Full Disk Access is recorded in system-level /Library/Application Support/com.apple.TCC/TCC.db (root-owned, requires elevated access to read)
• csreq blob: Each row contains a code-signing requirement to prevent tampering — mismatched bundle IDs and csreq are a tampering signal
• prompt_count: How many times the app has been asked. High counts on sensitive services (e.g., screen recording) can indicate suspicious behaviour
• Service vocabulary: kTCCServiceScreenCapture, kTCCServiceCamera, kTCCServiceSystemPolicyAllFiles, kTCCServiceAccessibility are the most forensically meaningful

Related Artifacts

• Persistence Mechanisms - TCC grants persist across reboots and tie back to installed agents
• Unified Logs - tccd subsystem logs each authorisation check
• Pattern of Life - Knowledge of which apps were used pairs with what they were authorised to access

References

• Apple TCC framework documentation
• Objective-See: Bypassing TCC